Acp agentic checkout endpoints

Under ACP's Agentic Checkout spec the merchant hosts the checkout: POST /checkout_sessions creates a session, POST /checkout_sessions/{id} updates it, POST .../complete and .../cancel finish or abort it, and GET retrieves it; status is not_ready_for_payment, ready_for_payment, completed or canceled. Requests carry Authorization, Idempotency-Key, Request-Id, an HMAC Signature, Timestamp and API-Version; responses return line_items, fulfillment_options, totals, messages and links to terms_of_use, privacy_policy and seller_shop_policies, and the merchant sends order_created and order_updated webhooks. Payment arrives through the Delegated Payment spec (POST /agentic_commerce/delegate_payment returns a one-time vault token limited by max_amount, currency, expires_at, merchant_id and checkout_session_id), which OpenAI reserves for PSPs and PCI DSS level 1 merchants with their own vaults; Stripe's Shared Payment Token was the first compatible implementation.